Microsoft Agent Framework 1.19.0 tightens MCP session identity scoping
Microsoft released Agent Framework version 1.19.0 on September 18, 2026, with breaking changes designed to enforce stricter identity and ownership controls for Model Context Protocol (MCP) sessions and requests AIChangeWatch.
Identity and Session Scoping
The core update modifies how the framework associates MCP requests and sessions with their invocation context. According to the release notes, version 1.19.0 now scopes MCP requests and sessions "to the correct invocation identity, origin, and ownership" AIChangeWatch. This change prevents cross-invocation session reuse and ensures that each MCP call carries its own authenticated context—a security-relevant shift for enterprise deployments where multi-tenant isolation matters.
HTTP Cookie Handling and Deprecations
The release also makes HTTP cookie persistence explicit by requiring developers to specify whether cookies belong to the framework or to the calling application. This breaks existing code that relied on implicit cookie handling, forcing developers to audit their agent integrations.
Among other deprecations, the update removes the MCP sampling callback, shifting sampling logic responsibility away from the callback pattern. Developers using this pattern will need to migrate to alternative approaches NewReleases.io.
Archive and Verification Changes
The framework now limits MCP skill archives to ZIP files and introduces digest verification for those archives. This constraint standardizes the packaging format and enables integrity checking—relevant for organizations distributing agent skills across teams or external markets.
Developer Impact
The breaking nature of these changes signals that Microsoft prioritizes security boundaries over backward compatibility in the agent framework. Developers maintaining production agents will need to update session management, cookie configuration, and callback implementations. The changes suggest a maturation phase in the framework's lifecycle, moving from loose compatibility toward stricter operational guardrails.
No timeline for deprecation of removed features or migration tooling has been announced.